Description
Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.
Remediation
References
https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2869
Related Vulnerabilities
CVE-2017-1000114 Vulnerability in maven package org.datadog.jenkins.plugins:datadog
CVE-2019-1003070 Vulnerability in maven package org.jenkins-ci.plugins:veracode-scanner
CVE-2017-1000113 Vulnerability in maven package org.jenkins-ci.plugins:deploy
CVE-2023-24450 Vulnerability in maven package org.jenkins-ci.plugins:view-cloner
CVE-2023-50730 Vulnerability in maven package edu.gemini:gsp-graphql-core_2.13